CAS-005 · Question #502
During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to install unapproved software and make unplanned configuration chan
The correct answer is B. Extend log retention for all security and network devices for 180 days for all traffic. E. Ensure all network and security devices are sending relevant data to the SIEM. Extending log retention ensures visibility into security and network activities for proper monitoring and forensic investigations. Ensuring all network and security devices send relevant data to the SIEM provides centralized monitoring and alerting, enabling the SOC to detect una
Question
During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to install unapproved software and make unplanned configuration changes. During an investigation, the following findings are identified:
- Several new users were added in bulk by the IAM team.
- Additional firewall and routers were recently added to the network
- Vulnerability assessments have been disabled for all devices for more
than 30 days.
- The application allow list has not been modified in more than two
weeks.
- Logs were unavailable for various types of traffic
- Endpoints have not been patched in more than ten days.
Which of the following actions would most likely need to be taken to ensure proper monitoring is in place within the organization? (Choose two.)
Options
- ADisable bulk user creations by the IAM team.
- BExtend log retention for all security and network devices for 180 days for all traffic.
- CReview the application allow list on a daily basis to make sure it is properly configured.
- DRoutinely update all endpoints and network devices as soon as new patches/hot fixes are
- EEnsure all network and security devices are sending relevant data to the SIEM
- FConfigure rules on all firewalls to only allow traffic from the production environment to the non-
How the community answered
(32 responses)- A6% (2)
- B50% (16)
- C28% (9)
- D3% (1)
- F13% (4)
Explanation
Extending log retention ensures visibility into security and network activities for proper monitoring and forensic investigations. Ensuring all network and security devices send relevant data to the SIEM provides centralized monitoring and alerting, enabling the SOC to detect unauthorized access or misconfigurations.
Community Discussion
No community discussion yet for this question.